IT Services Reference
Powered by

Updating the SAML Certificate

In 

Review the recorded certificate-renewal steps for Oliver SAML sign-on. The source distinguishes metadata-URL and metadata-XML setups and leaves automatic certificate refresh unconfirmed.

When the SAML token signing certificate expires on the Enterprise app it is necessary to generate a new one.

NOTE: If you originally used the "Import Idp Metadata URL" process (see more below), it may not be necessary to make any changes in Oliver, as it should automatically update the token signing certificate once it is renewed in Entra ID. However if you used the "Import Idp Metadata XML" process when originally setting up Oliver you may need to complete step 2.

Step 1: Update the certificate in Entra ID Enterprise App

  • Logon to Entra ID and PIM to Application Administrator role as a minimum.
  • Browse to Enterprise apps and search for "oliver".
  • Your Enterprise app may display Expired in the Certificate Expiry Status column. Select your Enterprise app.
  • Select Single Sign-on
  • In the SAML Certificates section click the Edit button.

Screenshot retained for review

  • Click the New Certificate button and just accept the defaults and click Save. This should produce a certificate that has a 3 year expiry by default.
  • The source recommends adding Notification Email Addresses.
  • Note that the new certificate is listed as Inactive.
  • Click the Ellipses (3 dots) on the Inactive Certificate and select Make certificate active. BIG WARNING: As soon as you do this, the Enterprise application will immediately start using this certificate. This is true REGARDLESS of whether the current certificate is expired or still active. As soon as you make a new certificate active the old is made inactive. This will not close any open Oliver sessions, but may prevent new logons if you originally used the "Upload Idp Metadata XML" process. So do this step after hours preferably.

Screenshot retained for review

  • Click Save and close the SAML Signing Certificate slide out with the X.

Step 2: Update the Oliver v5 SAML Config

This is only required if you originally used the "Upload Idp Metadata XML" process when configuring Oliver, or if Oliver doesn't automatically pick up the new certificate once renewed as above.

  • Still in Single sign-on>SAML Certificates section, copy the App Federation Metadata URL. (This is the easiest method as it avoids having to download anything).
  • Sign on to Oliver v5 and browse to the management portal. NOTE: If you haven't already signed on to Oliver v5 but you have already changed the certificate and killed SAML logon, you will need to logon using non-SSO administrator credentials using the non-SSO url. E.g. https://cornerstone.softlinkhosting.com.au/oliver/home?corporation=CornerstoneChristianCollege&sso=false You MUST obviously know the non-SSO username and password.
  • Once in the Oliver Management portal, browse to Management>Parameters and search for "8250" to open [8200-8299} SAML configuration settings and click the Edit button on the right.
  • Scroll down to parameter 8279 and click Import Idp metadata URL.
  • In the popup paste the previously copied App Federation Metadata URL and click OK.

Screenshot retained for review

  • Unconfirmed observation: when testing an App Federation Metadata URL configuration, the author could rotate two certificates without changing Oliver. Automatic refresh was suspected and explicitly required further testing; do not treat it as an established renewal result.